Patch digest › 19–25 Oct 2026
Patch digest: 19–25 Oct 2026
What to patch from the week of 19–25 Oct 2026: 6 fixes, 2 actively exploited: Node.js 24.22.1, 22.23.4, 26.12.1, PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, curl on Ubuntu, OpenSSH on Ubuntu, Ghostscript on Ubuntu, zlib on Ubuntu. Actively exploited flaws first. Get it by email every Monday.
In brief
Two of this week's six fixes are for flaws attackers are already using: Node.js 24.22.1, 22.23.4, 26.12.1 (rated 9.8, plus 8 related flaws); PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (rated 9.8, plus 1 related flaw). Patch those first.
Also fixed: curl on Ubuntu (rated 9.1, plus 17 related flaws); OpenSSH on Ubuntu (rated 7.8, plus 8 related flaws); Ghostscript on Ubuntu (rated 7.8, plus 1 related flaw); zlib on Ubuntu (rated 7.4).
On Ubuntu, four of these come with one apt upgrade.
The fixes
Node.js: a memory corruption flaw (CVE-2026-111497, rated 9.8 out of 10) that attackers are already using, and 8 more fixed with it.
What to do: Update Node.js to 24.22.1 or 22.23.4 or 26.12.1 or later (whichever is on your release line).
Node.js 24.22.1 security release: Security release on the 24.x line (Krypton LTS).
Affected: Earlier releases on each of those lines · Fixed in: 24.22.1, 22.23.4, 26.12.1 · CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073 and 3 more · Source
PHP: a memory corruption flaw (CVE-2026-109618, rated 9.8 out of 10) that attackers are already using, and 1 more fixed with it.
What to do: Update PHP to 8.5.12 or 8.4.27 or 8.3.36 or 8.2.35 or later (whichever is on your release line).
PHP 8.5.12 released: Bug-fix and security release.
Affected: Earlier releases on each of those lines · Fixed in: 8.5.12, 8.4.27, 8.3.36, 8.2.35 · CVE-2026-109618, CVE-2026-109619 · Source
curl on Ubuntu: an information disclosure flaw (CVE-2026-86414, rated 9.1 out of 10), and 17 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses curl.
USN-8927-2: curl vulnerabilities: Several security issues were fixed in curl.
Affected: Ubuntu 26.10 · CVE-2026-107928, CVE-2026-107929, CVE-2026-86409, CVE-2026-86410, CVE-2026-86412, CVE-2026-86414 and 12 more · Source
OpenSSH on Ubuntu: a path traversal flaw (CVE-2026-106583, rated 7.8 out of 10), and 8 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses OpenSSH.
USN-8937-1: OpenSSH vulnerabilities: Several security issues were fixed in OpenSSH.
Affected: Ubuntu 26.10 · CVE-2026-106552, CVE-2026-106553, CVE-2026-106555, CVE-2026-106582, CVE-2026-106583, CVE-2026-106584 and 3 more · Source
Ghostscript on Ubuntu: a memory corruption flaw (CVE-2026-101258, rated 7.8 out of 10), and 1 more fixed with it.
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses Ghostscript.
USN-8949-1: Ghostscript vulnerabilities: Several security issues were fixed in Ghostscript.
Affected: Ubuntu 26.10, 26.04, 24.04, 22.04, 20.04, 18.04, 16.04 · CVE-2026-101258, CVE-2026-103226 · Source
zlib on Ubuntu: a memory corruption flaw (CVE-2026-85091, rated 7.4 out of 10).
What to do: Install the Ubuntu security updates (apt update, then apt upgrade) and restart what uses zlib.
USN-8954-1: zlib vulnerability: zlib could be made to crash or run programs if it received specially crafted input.
Affected: Ubuntu 26.10, 26.04, 24.04 · CVE-2026-85091 · Source
Rather someone else did the patching?
Managed servers get security fixes within hours, tested and rolled back if anything breaks. Or start with the free outside check of your site.